T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run_story.py:64- Finding
API Credentials Can Be Exfiltrated Through Unvalidated Custom Endpoints
- Content
View full analysis
None: if load_dotenv is None: return for path in (SKILL_DIR / ".env", Path.cwd() / ".env"): if path.exists(): load_dotenv(path) def refresh_runtime_settings() -> None: global LLM_BASE_URL, LLM_MODEL, LLM_API_KEY, LLM_TIMEOUT, LLM_TEMPERATURE global TTS_URL, TTS_MODEL, TTS_API_KEY, TTS_TIMEOUT LLM_BASE_URL = os.environ.get("STORY_LLM_BASE_URL", "https://models.audiozen.cn/v1") LLM_MODEL = os.environ.get("STORY_LLM_MODEL", "doubao-seed-2-0-lite-260215") LLM_API_KEY = os.environ.get("STORY_LLM_API_KEY", os.environ.get("IME_MODEL_API_KEY", "")) LLM_TIMEOUT = float(os.environ.get("STORY_LLM_TIMEOUT", "90")) LLM_TEMPERATURE = float(os.environ.get("STORY_LLM_TEMPERATURE", "0.7")) TTS_URL = os.environ.get("STORY_TTS_URL", "https://api.senseaudio.cn/v1/t2a_v2") TTS_MODEL = os.environ.get("STORY_TTS_MODEL", "SenseAudio-TTS-1.0") TTS_API_KEY = os.environ.get("SENSEAUDIO_API_KEY", "") TTS_TIMEOUT = float(os.environ.get("STORY_TTS_TIMEOUT", "60")) def require_env(name: str, value: str) -> str: if value: return value raise SystemExit(f"缺少必要配置: {name}") def build_client() -> OpenAI: api_key = require_env("STORY_LLM_API_KEY / IME_MODEL_API_KEY", LLM_API_KEY) return OpenAI(api_key=api_key, base_url=LLM_BASE_URL, timeout=LLM_TIMEOUT) ``` ```python def synthesize_tts(text: str, voice_cfg: dict[str, Any], tag: str) -> bytes | None: """Synthesize a single TTS segment and return raw MP3 bytes.""" if not text: return None api_key = require_env("SENSEAUDIO_API_KEY", TTS_API_KEY) headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"} voice_setting: dict[str, Any] ...[truncated 2727 chars]- Remediation
View remediation